A DevSecOps team already runs SAST during the code-commit stage and scans container images in the registry before deployment. During a security review, an auditor notes that authentication-bypass and session-handling flaws only appear when the application is actually running and processing requests. The team wants to add automated testing to the CI/CD pipeline that detects these runtime vulnerabilities against a deployed staging instance. Which testing approach should they add?